Square Is Reviewing My Med Spa Account: What To Do Next

If Square is reviewing your med spa or clinic account, treat it as a documentation and risk-verification event, not a reason to guess at the cause. The safest response is to gather accurate business, ownership, licensing, and transaction records, respond only to the request you received, and avoid changing your story or submitting incomplete files while the review is open.

What you should not do is just as important: do not ignore deadlines, do not send conflicting information, and do not assume a payment review is the same thing as a clinical, legal, or regulatory clearance. For healthcare businesses, processor reviews can overlap with enrollment, identity, licensure, and documentation issues that need a fact-specific check.

Why a processor review matters for healthcare businesses

Square-specific review criteria are not verified in the approved federal source set, so no one should pretend to know exactly why your account was flagged without seeing the notice and the records involved. What is clear is that healthcare businesses are often asked to prove who they are, where they operate, and whether the business information on file still matches reality.

CMS says Medicare providers and suppliers must keep enrollment information current and report certain changes quickly: within 30 days for ownership, adverse legal action, and practice location changes, and within 90 days for other changes. That matters because mismatched entity data can create problems far beyond billing, including processor review friction. CMS also warns that providers can face revocation risk if enrollment information is not kept current.

For med spas and clinics, a review can also touch licensing or service-scope questions. CMS’s 1135 waiver guidance is explicit that federal reimbursement flexibilities do not override state law on whether a non-Federal provider is authorized to practice without state licensure. In other words, state licensure still matters, even if a federal program has temporary flexibility.

The fastest way to respond: a 4-part review workflow

Use this sequence instead of improvising:

What documents to prepare

The exact request will vary, but the approved sources support a practical document set for healthcare businesses under review:

• legal business name and current ownership information, especially if ownership changed recently; CMS requires ownership changes to be reported promptly in enrollment contexts;
• current practice or service-location information;
• state licensure documentation for the state where services are actually provided;
• Medicare enrollment or revalidation materials if the business participates in Medicare;
• transaction records and related business documents if the issue may involve identity theft or fraud concerns.

FTC guidance is also useful here. If a business is asked for identity-theft-related transaction records, the FTC says requests must be in writing and may include invoices, credit applications, or account statements. That does not mean every processor review is an identity-theft case; it means your record-keeping should be organized enough to support a clean response if it becomes one.

If your med spa handles cosmetic products, remember that FDA may inspect cosmetic firms without prior notice to check safety, labeling, and possible violations. That is a separate regulatory lane from payment processing, but it is one reason healthcare and aesthetics businesses should keep operations tidy.

What not to do during the review

A processor review gets worse when owners react fast but not carefully. Avoid these mistakes:

• do not ignore the notice or miss the deadline;
• do not send partial documents if the request clearly asked for a full set;
• do not change ownership, website language, or service descriptions mid-review unless you are deliberately updating the business record and can explain it;
• do not assume card acceptance alone makes you covered by FTC Red Flags Rule requirements; the FTC says accepting credit cards by itself does not make a business a creditor under that rule;
• do not assume federal flexibilities override state licensure requirements.

That last point matters for med spas especially. If your business model relies on a medical director, professional supervision, scope-of-practice limits, or a cosmetology/aesthetics structure, the processor may be seeing a documentation issue that is actually rooted in state-law compliance. WhiteLabelClinic.com and MDLaunchr help businesses evaluate those infrastructure questions, but they do not replace state board or counsel review.

How to judge whether this is just a document check or something bigger

A processor review usually falls into one of three buckets. You do not need to guess, but you do need to triage.

1) Routine verification

This is the most common operational bucket. The processor asks for business identity, ownership, website, or transaction support. The right move is to answer the request directly and keep the response consistent.

2) Compliance mismatch

This happens when the processor file, website, bank account, or invoicing records do not line up. For healthcare businesses, mismatches often involve the legal entity, owner names, practice locations, or the way services are described online.

3) Regulatory or billing concern

If the request ties to state licensure, Medicare enrollment, reimbursement, or possible fraud/identity-theft concerns, the issue is no longer just a payment ops task. CMS notes that enrollment information must stay current, and it also operates a Victimized Provider Project for providers who claim they were victims of identity theft and suffered Medicare overpayments or debts.

A checklist you can finish before replying

Use this before you upload anything:

• confirm the exact legal entity on the processor account;
• verify the business address and practice location match current operations;
• collect current ownership documentation;
• confirm the relevant state license status for the service location;
• save the processor notice and deadline;
• pull recent invoices, statements, or transaction records if requested;
• review the website and checkout language for anything that could be read as inconsistent with the actual business model;
• if Medicare is part of the picture, verify enrollment/revalidation status;
• if the request suggests identity theft or fraud, preserve records before making changes.

Where MDLaunchr fits in

This kind of review is often a systems problem, not just a bank problem. MDLaunchr, the brand behind WhiteLabelClinic.com, helps qualified businesses evaluate the technology, operational, compliance, clinical-network, and fulfillment relationships involved in launching or stabilizing telehealth services. That makes it useful when an account review is really exposing a bigger infrastructure gap.

If you are dealing with a processor hold, reserve, or document request and need a structured next step, request an emergency processing review. The goal is not to promise an outcome; it is to help you assemble the right facts, identify the real issue, and move toward a compliance-first path.

When you need outside review immediately

Escalate to qualified counsel, a compliance professional, or your operational advisor if any of these are true:

• the processor asks about licensure, ownership, or prohibited services;
• the business provides services in more than one state;
• your med spa model depends on state-specific supervision or delegation rules;
• Medicare, Medicaid, or other reimbursement rules are part of the business model;
• you suspect identity theft, account takeover, or document fraud;
• your records do not match what is currently on the processor profile.

The point is not to over-lawyer every request. It is to avoid treating a serious infrastructure issue like a simple customer-service ticket.

Bottom line

If you are searching for square account under review healthcare help, start with records, not assumptions. Organize the legal entity details, licensing, location proof, and transaction documentation, then respond carefully and consistently. In healthcare and aesthetics businesses, a payment review often exposes a broader operations issue that needs a disciplined fix.

If you want help evaluating the infrastructure behind the review, MDLaunchr and WhiteLabelClinic.com can support a compliance-first telehealth launch and operating review.

FAQs

Why is Square reviewing my clinic account?

The approved sources do not verify Square’s internal review logic. In healthcare businesses, though, account reviews commonly overlap with identity, ownership, location, licensure, or transaction documentation checks.

What documents should I send if Square is requesting documents for my medical business?

Start with legal entity records, ownership information, current practice or service-location details, relevant state licensure, and any transaction records specifically requested. Only send what the notice asks for unless you have confirmed more is needed.

Can a processor review affect a med spa that is cash-pay only?

Yes. Even without insurance billing, a med spa can still face documentation issues tied to business identity, service descriptions, licensing, or transaction integrity.

Does accepting cards make my business subject to the FTC Red Flags Rule?

No. The FTC says card acceptance by itself does not make a business a creditor under that rule. Coverage depends on whether the business is actually a covered financial institution or creditor with covered accounts.

What if the review is really about a state licensing issue?

Then the issue needs a state-specific review, because CMS says state law still governs whether a non-Federal provider is authorized to provide services without state licensure. A processor review can reveal that mismatch even if it is not the processor’s job to resolve it.

Should I change my website while the account is under review?

Only if the current site is inaccurate and you can update it consistently across all records. Random changes during a review can create more mismatch problems, not fewer.